WordPress WP Coder plugin 4.0-4.5.1 - Editor+ RCE vulnerability

Editor+ RCE vulnerability discovered by Ayush Srivastava in WordPress Plugin WP Coder versions 4.0-4.5.1...

CVE-2026-104677

The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromi...

CVE-2026-104677 WP Coder 4.0 - 4.5.1 - Editor+ RCE via Global PHP

The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromi...

CVE-2026-104677

The WP Coder WordPress plugin (versions 4.0-4.5.1 ) contains a vulnerability where the PHP code-execution feature is not restricted to administrators. Instead, it is gated on a content capability held by the Editor role by default. This allows users with Editor-level privileges to save and execut...

CVE-2026-104677 WP Coder 4.0 - 4.5.1 - Editor+ RCE via Global PHP

The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromi...

EUVD-2026-94182

The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromi...

PT-2026-107405

The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromi...

CVE-2024-2578

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPCoder WP Coder allows Stored XSS.This issue affects WP Coder: from n/a through 3.5...

EUVD-2024-27527

Malicious code in bioql PyPI...

EUVD-2025-3891

Malicious code in bioql PyPI...

EUVD-2023-12884

Malicious code in bioql PyPI...

CVE-2023-0895

The WP Coder – add custom html, css and js code plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

CVE-2021-25053

The WP Coder WordPress plugin before 2.5.2 within the wow-company admin menu page allows to include arbitrary file with PHP extension as well as with data:// or http:// protocols, thus leading to CSRF RCE...

CVE-2025-24699

Cross-Site Request Forgery CSRF vulnerability in Wow-Company WP Coder wp-coder allows Cross-Site Scripting XSS.This issue affects WP Coder: from n/a through = 3.6...

CVE-2025-24699

Cross-Site Request Forgery CSRF vulnerability in Wow-Company WP Coder wp-coder allows Cross-Site Scripting XSS.This issue affects WP Coder: from n/a through = 3.6...

CVE-2025-24699

CVE-2025-24699 : WordPress WP Coder plugin is affected (versions up to 3.6). The issue is a CSRF that enables Cross‑Site Scripting (XSS) via the vulnerable plugin code. Public records identify the nature of the vulnerability as CSRF to XSS in WP Coder <= 3.6. Red Hat/RedHat-related and CVE dat...

CVE-2025-24699 WordPress WP Coder Plugin <= 3.6 - CSRF to Cross Site Scripting (XSS) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Wow-Company WP Coder allows Cross-Site Scripting XSS. This issue affects WP Coder: from n/a through 3.6...

CVE-2025-24699 WordPress WP Coder Plugin <= 3.6 - CSRF to Cross Site Scripting (XSS) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Wow-Company WP Coder wp-coder allows Cross-Site Scripting XSS.This issue affects WP Coder: from n/a through = 3.6...

PT-2025-7034

Name of the Vulnerable Software and Affected Versions: Wow-Company WP Coder versions 3.6 and earlier Description: A Cross-Site Request Forgery CSRF issue allows Cross-Site Scripting XSS. This means an attacker can trick a user into performing unintended actions on a web application, potentially...

WordPress plugin WP Coder 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request...